How to allow Search Engine Robots/Slurps through ASM?

In addition to what Brailsford might have to add...

 

 

There is a check for 'Several Content-Length headers'. So if the request smuggling attack depends on more than one Content-Length headers, it should be blocked with that check.

 

 

You could try to contact Yahoo and ask why they include the LLF-Cache-Control header in their requests. I couldn't find any reference to it in any RFC or other document. I assume your web server would ignore it whether there was a value set or not.

 

 

You could also use an iRule to rewrite the LLF-Cache-Control header to a static value for requests with a Yahoo search string in the User-Agent field. You could also remove it altogether from all requests. This seems like a bit of unnecessary overhead though if ASM can protect against the attack with other checks.

 

 

Aaron